PT-2016-6522 · Apache+1 · Netbeans+1

Hyp3Rlinx + 1 · Published 2016-10-25 · Updated 2018-10-09 · CVE-2016-5537

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware 8.1

Description The issue affects confidentiality, integrity, and availability. It is reportedly related to a directory traversal vulnerability, which may allow local users with certain permissions to write to arbitrary files and gain privileges by using a .. (dot dot) in a ZIP file imported as a project.

Recommendations For Oracle Fusion Middleware 8.1, consider restricting access to the NetBeans component until a fix is available. As a temporary workaround, avoid importing ZIP files as projects that may contain malicious archive entries.

Exploit

Fix

Related Identifiers

CVE-2016-5537

Affected Products

Netbeans

Oracle Fusion Middleware

References · 14

• 🔥 https://exploit-db.com/exploits/40588 · Exploit
• 🔥 http://hyp3rlinx.altervista.org/advisories/ORACLE-NETBEANS-IDE-DIRECTORY-TRAVERSAL.txt · Exploit
• 🔥 http://packetstormsecurity.com/files/139259/Oracle-Netbeans-IDE-8.1-Directory-Traversal.html · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-5537 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-5537 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-5537 · Vendor Advisory
• http://oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-5537 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-5537 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2016-5537 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-5537 · Security Note
• http://securitytracker.com/id/1037051 · Note
• http://securityfocus.com/bid/93686 · Note
• http://securityfocus.com/archive/1/539615/100/0/threaded · Note